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1 1 MAR 1980 


MEMORANDUM FOR: Chief, Policy and Plans Group, OS 


FROM: 


Information Systems Security Group, OS 


SUBJECT: 


Review of APEX Manual 


These are some informal comments on content and 
form. Many are based on general background knowledge 
rather than specific Information Systems Security Group 
(ISSG) items. Each comment is identified with the 
paragraph number: 


16C There should be a specific time for tracers 
to be sent. This will guide not only the cont ractor 
but also the responsible government officials. 


26. Paragra ph ends with a colon and has no 
classification. 1 i 


* 

ntf*' & 


38. 'This level of operational' on first line 
is in heavy print which is not cons istent with 
preceding and following paragraphs.! 


> 0° 

'i |A ft f jf Government security types rotate frequently and if 
tr There is a lack of documentation, the contractor / 

9. u 1 J will proceed even if there might be a change in 
-•gd The scope of the contract. The small number of 

' a Q , ^employees for an R$D effort may incre ase to a larger 
r V 9 if number for a production effort. 


a hu. Although specific or approximate numbers 
V yfT have been avoided there could be a problem over time 


r '/ Government 




49. May we assume that the SIO in our case is 
Mr. Carlucci? I think that DCID 1/16 should be 
cited here also, e.g., 'In compliance with DCID 1/16 
and standard requirements, etc.' AJ.s,o, change title of 
paragraph to Information Systems Security to reflect 
cognizance over these systems. 
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50. It doesn't seem clear what they mean by 
the 'Government official will arrange .... any 
required corrective measures.' It would seem 
that the contractor would be advised of the 
corrective measures that he had to have corrected. 


25: 


62/63. This is a little different from the past 
in the Agency anyway. 0D$E used to require three 
wraps, with the 'Government Property' label on the 
outside, the finder of a lost document will not have 
to open it to the second wrap to find out that infor- 
mation. 


77. This parag raph has not been classified, but 
shows a m . 1 



80. The items mentioned must be accounted for by 
some type of numbering system. They require accounting V 
but do not s pecify that an APEX number must be on the 
label . 


81. These should be subject to individual 
accountability. There has been numbe ring an d control 
in the past and should be continued. 



85. Each fiche should be subject to individua l 

n ^ 

one or more S CI docu ments but is controlled by a // 

r .. 

/y, 




pouch number. 


87. No c lassifi cation on this paragraph either 
Another (?) . 
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95. This may be an impossible task for an ASO. 
Paragraph 17D lists one of the duties of the CASO as 
conducting security indoctrinating and debriefings. 
This seems to require some clarification. All 
paragraphs but two have unclassified notations. 

The other two have question marks. The overall 
classification, however, is Confidential. 

Apparently they felt a compilation of all para- 
graphs warranted the classification, 1 1 

51. There is only one ' 
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